Data Migration

The biggest threat to your data isn’t happening tomorrow. It happened yesterday. If you haven’t heard of HNDL (Harvest Now, Decrypt Later), your long-term data strategy has a massive blind spot. Here is the reality: State actors and cybercriminals are capturing your encrypted data today. They can’t read it yet, so they’re storing it in massive data vaults, waiting for the "Qday"—the moment quantum computers become powerful enough to break current encryption. If your data needs to stay private for 5, 10, or 20 years, it’s already at risk. What’s on the line? ↳ Intellectual Property (IP) and trade secrets. ↳ Government and identity data. ↳ Long-term financial records and contracts. ↳ Sensitive customer health data. How do we solve it? 🛠️ We cannot wait for quantum supremacy to react. The fix starts now: ↳ Inventory: Identify which data has a long shelf-life. ↳ Crypto-Agility: Move toward systems that can swap encryption methods without a total overhaul. ↳ Hybrid PQC: Implement Post-Quantum Cryptography alongside classical methods to ensure traffic captured today remains a mystery tomorrow. The transition to quantum-resistant security is a marathon, not a sprint. Are you tracking HNDL on your current risk register? Let’s discuss in the comments. 👇 P.S. If you want help mapping your exposure or building a PQC migration plan, drop me a message. ♻️ Share this post if it speaks to you, and follow me for more. #QuantumSecurity #PQC

The imperative to prepare for the transition to quantum-safe cryptography doesn't necessarily mean an immediate switch. Consider these two critical aspects: ☝ Complexity of Cryptographic Algorithm Transition: Transitioning cryptographic algorithms is a complex undertaking. A quick examination within your organization or with your service providers may reveal the use of obsolete algorithms like SHA-1 or TDEA. For example, the payment card industry still employs TDEA, despite its obsolescence was announced in 2019. It's essential to enhance your organization's cryptography management capabilities before embarking on the transition to quantum-safe cryptography. ✌ Scrutiny Required for New PQC Algorithms: The new Post-Quantum Cryptography (PQC) algorithms are relatively recent and warrant careful examination. Historically, we have deployed cryptographic algorithms on a production scale only after several years of existence, allowing comprehensive scrutiny. While PQC standardization offers some security assurances, it doesn't cover the software implementations deployed in your environment. Consider employing phased deployments and hybrid implementations to avoid compromising the existing security provided by classical cryptography. Recent news, as mentioned in this article, highlights the immaturity of implementations of new PQC algorithms. While the title might be somewhat misleading, it's crucial to recognize that occasional flaws in implementations, like those found (and solved) in various instances of Kyber, serve as reminders. As we transition to these new implementations, we must first gain control over our cryptography. Here's a suggested action plan: 🚩 Cryptography Management: Prioritize gaining control over your cryptography. 🚩 Understanding Quantum-Safe Cryptography: Familiarize yourself with the development of quantum-safe cryptography. 🚩 Transition Plan Preparation: Follow recommendations to prepare a comprehensive transition plan. Some of my favourite resources are: - Federal Office for Information Security (BSI)'s "Quantum-safe cryptography" (https://lnkd.in/dqkSAQSP) - Government of Canada CFDIR's "BEST PRACTICES AND GUIDELINES" (https://lnkd.in/d-w_Nbfj) - National Institute of Standards and Technology (NIST)'s "Migration to Post-Quantum Cryptography" (https://lnkd.in/dYMKnqBb) 🚩 Decision-Making: Make informed decisions based on the acquired knowledge. In summary, a thoughtful and phased approach is key to ensuring a smooth transition to quantum-safe cryptography. https://lnkd.in/dxAgF2ac #cryptography #quantumcomputing #security #pqc #cybersecurity

🛡️ The Quantum Clock is Ticking quietly: Is Your Financial Infrastructure Ready? The financial industry is built on a foundation of digital trust, currently secured by #cryptographic standards like RSA and ECC. However, the rise of Cryptographically Relevant Quantum Computers (CRQC) poses an existential threat to this foundation. As we navigate this transition, here are 3 key pillars from the latest Mastercard R&D white paper that every financial leader must prioritize: 1. Addressing the 'Harvest Now, Decrypt Later' (HNDL) Threat 📥 Malicious actors are already intercepting and storing sensitive #encrypted data today, intending to decrypt it once powerful quantum computers are available. Financial Use Case: Protecting long-term assets such as credit histories, investment records, and loan documents. Unlike transient transaction data (which uses dynamic cryptograms), this "shelf-life" data requires immediate risk analysis and the adoption of quantum-safe encryption for back-end systems. 2. Quantum Resource Estimation & The 10-Year Horizon ⏳ While a CRQC capable of breaking RSA-2048 in hours might be 10 to 20 years away, the migration process itself will take years. Financial Use Case: Developing Agile Cryptography Plans. Financial institutions should set "action alarms" for instance, once a quantum computer reaches 10,000 qubits, a pre-prepared 10-year migration plan must be triggered to ensure infrastructure is updated before the "meteor strike" occurs. 3. Hybrid Implementations: The Bridge to Security 🌉 The transition won't happen overnight. The paper highlights the importance of Hybrid Key Encapsulation Mechanisms (KEM), which combine classical security with PQC. Financial Use Case: Enhancing TLS 1.3 and OpenSSL 3.5 protocols. By implementing hybrid models now, banks can protect against current quantum threats (like HNDL) while maintaining compatibility with existing classical systems, ensuring a smooth and safe transition. The Bottom Line: A reactive approach is no longer an option. Early adopters who evaluate their data's "time value" and begin the migration today will be the ones to maintain resilience and protect global financial assets tomorrow. #QuantumComputing #PostQuantumCryptography #FinTech #CyberSecurity #DigitalTrust #MastercardResearch

🚨 NEW PEER-REVIEWED RESEARCH: PQC Migration Timelines Excited to share my latest paper published in MDPI Computers: "Enterprise Migration to Post-Quantum Cryptography: Timeline Analysis and Strategic Frameworks." The transition to Post-Quantum Cryptography (PQC) represents a watershed moment in the history of our digital civilization. Organizations planning for a 3-5 year "upgrade" will fail. The reality is a 10-15-year systemic transformation. Key Contributions: 📊 Realistic Timeline Estimates by Enterprise Size: Small (≤500 employees): 5-7 years Medium (500-5K): 8-12 years Large (>5K): 12-15+ years ⚠️ Critical Finding: With FTQC expected 2028-2033, large enterprises face a 3-5 year vulnerability window—migration may not complete before quantum computers break RSA/ECC. 🔬 Novel Framework Analysis: Causal dependency mapping (HSM certification, partner coordination as critical paths) "Zombie algorithm" maintenance overhead quantified (20-40%) Zero Trust Architecture implications for PQC 💡 Practical Guidance: Crypto-agility frameworks and phased migration strategies for immediate action. Strategic Recommendations for Leadership: 1. Prioritize by Data Value, Not System Criticality: Invert the traditional triage model. Systems protecting long-lived data (IP, PII, Secrets) must migrate first, regardless of their operational uptime criticality, to mitigate SNDL. 2. Fund the "Invisible" Infrastructure: Budget immediately for the expansion of PKI repositories, bandwidth upgrades, and HSM replacements. These are long-lead items that cannot be rushed. 3. Establish a Crypto-Competency Center: Do not rely solely on generalist security staff. Invest in specialized training or retain dedicated PQC counsel to navigate the mathematical and implementation nuances. The talent shortage will only worsen. 4. Demand Vendor Roadmaps: Contractual language must shift. Procurement should require vendors to provide binding roadmaps for PQC support. "We are working on it" is no longer an acceptable answer for critical supply chain partners. 5. Embrace Hybridity: Accept that the future is hybrid. Design architectures that can support dual-stack cryptography indefinitely, viewing it not as a temporary bridge but as a long-term operational state. 6. Implement Automated Discovery: You cannot migrate what you cannot see. Deploy automated cryptographic discovery tools to continuously map the cryptographic posture of the estate, identifying shadow IT and legacy instances that manual surveys miss. The quantum clock is ticking. Start planning NOW. https://lnkd.in/eHZBD-5Y 📄 DOI: https://lnkd.in/ejA9YpsG #PostQuantumCryptography #Cybersecurity #QuantumComputing #PQC #InfoSec #NIST #CryptoAgility

🔐Word o’ the Day | Year | Decade: Crypto-agility, Baby! Yesterday morning, I did a fun fireside chat with Bethany Gadfield - Netzel at the FIA, Inc. Expo in Chicago. We talked about cyber resilience, artificial intelligence, Rubik’s cubes, and that thing called quantum! A question came up at the end, “What can firms actually do today to begin transitioning to post-quantum cryptography?” So thought I would take the opportunity to share my thoughts more broadly on this important, but not super well understood, topic: 1. Don’t wait. The clock for quantum-safe cryptography is already ticking. NIST released its first set of post-quantum standards last year (https://lnkd.in/esTm8uPw) and CISA put out a “Strategy for Migrating to Automated Post-Quantum Discovery and Inventory Tools” last year as part of its broader Post Quantum Cryptography (PQC) Initiative (https://lnkd.in/evpF4umv). h/t Garfield Jones, D.Eng.! 2. Inventory & prioritize. Map all cryptographic usage: what keys, certificates, protocols, and data streams exist today? Which assets hold long-lived value and are at risk of “harvest-now, decrypt-later”? Build a migration roadmap that prioritizes highest-risk systems (e.g., financial settlement platforms, inter-bank links, legacy encryption). 3. Establish crypto-agility. Ensure your architecture supports swapping algorithms, updating certificates, & layering classical + post-quantum primitives without a full system rebuild. This kind of flexibility is key for resilience. 4. Pilot and migrate. Use the new NIST-approved algorithms; experiment first on less time-sensitive systems, validate performance and interoperability, then scale to mission-critical applications. NIST’s IR 8547 report provides a framework for this transition. 5. Vendor & supply-chain alignment. Ask your vendors & service providers: “What’s your PQC transition plan? When will you support NIST-approved post-quantum algorithms? Are your update paths crypto-agile?” If the answer isn’t clear or (as a former boss of mine used to say) they look at you like a “pig at a wristwatch,” you’ve got a potentially serious third-party risk. 6. Board and Exec engagement. Position this not as an IT problem but a fiduciary risk and resilience imperative. The transition to quantum-safe cryptography is multi-year and multi-layered—waiting until it’s urgent means it will be too late.

🔐Europol PRIORITISING POST-QUANTUM CRYPTOGRAPHY MIGRATION ACTIVITIES IN FINANCIAL SERVICES ⚛️As post-quantum cryptography (PQC) becomes integrated into mainstream information technology (IT) products and services, financial services institutions must begin to execute their transition strategies. This document provides actionable guidelines to incorporate quantum safety into existing risk management frameworks by assessing the ‘Migration Priority’ based on the ‘Quantum Risk’ and ‘Migration Time’ of business use cases and highlighting opportunities for immediate execution. ⚛️A critical first step is to inventory all business use cases that rely on public key cryptography. This inventory enables the creation of a prioritised transition roadmap by assessing the Quantum Risk of each use case based on three parameters: 🟣 Shelf Life of Protected Data: How long the data remains sensitive. 🟣 Exposure: The extent to which data is accessible to potential attackers. 🟣 Severity: The business impact of a potential compromise. ⚛️When the Quantum Risk is assessed, organisations can prioritise actions based on each use case’s Migration Time, i.e., the complexity and timeline required to achieve Quantum Safety for a use case. As part of this activity, organisations will identify, for instance, actions that can be launched immediately and the use cases that require coordination with long-term asset lifecycles. 🟣 Solution Availability: Maturity of PQC standards, and their general availability in products and services. 🟣Execution Cost: The effort, cost, and complexity of implementing the quantum-safe solutions within the organisation. 🟣 External Dependencies: Execution complexity due to coordination required with third parties and their transition roadmaps (standardisation bodies, vendors, peers, regulators, and customers). ⚛️Examples of use cases that financial organisations can begin implementing today include: 🟣 Integration of post-quantum requirements into the long-term roadmap for hardware-intensive use cases aligned with financial asset lifecycles. 🟣 Enhancement of confidentiality protection for transactional websites. 🟣Identification and elimination of cryptographic antipatterns to reduce future technical debt. ⚛️These are examples of how financial institutions can take timely, structured steps toward an efficient and forward-looking transition to post-quantum cryptography. https://lnkd.in/d4qiS6X9

The NIST Special Publication 800-131Ar3 (Initial Public Draft) is an important document for organizations managing sensitive information through cryptographic methods. It provides detailed guidance on how to transition from older, less secure cryptographic algorithms and key lengths to newer, more robust ones, especially in anticipation of the potential threats posed by quantum computing. This draft outlines several key changes and recommendations: • Phasing Out Weak Algorithms: The document proposes the retirement of certain cryptographic algorithms, such as the Data Encryption Standard (#DES) and older hash functions like #SHA-1, which are increasingly vulnerable to attacks. It sets a deadline of December 31, 2030, for the retirement of the 224-bit hash functions and states that these algorithms should no longer be used after this date. • #Quantum-Resistant Algorithms: Recognizing the future risk posed by quantum computers, which could break many classical encryption methods, the document emphasizes a shift towards quantum-resistant #algorithms. NIST has already begun standardizing these algorithms, and the publication provides a roadmap for their gradual implementation. The goal is to move from the traditional 112-bit security strength (which may become vulnerable to quantum attacks) to a 128-bit security strength and eventually to quantum-resistant cryptographic methods. • New Standards: This version introduces updates for digital signatures, key encapsulation mechanisms (#KEMs), and key derivation methods. Algorithms like DSA (Digital Signature Algorithm) are being retired, while lattice-based and hash-based digital signatures, which are resistant to quantum attacks, are being recommended. • Security Strength Transition: #NIST plans for a transition to 128-bit security strength for block ciphers and other encryption mechanisms by January 1, 2031. For digital signatures and key establishment, a direct transition to quantum-resistant methods is recommended as soon as those standards are available. This guidance is aimed at government agencies and organizations handling sensitive but unclassified data. It stresses the importance of proactive planning and “cryptographic agility”—the ability to switch to new, stronger algorithms as needed to stay ahead of evolving security threats.

While current quantum computers are not yet powerful enough to break widely used cryptographic systems, progress is accelerating. This puts financial institutions on notice: many commonly used public-key cryptographic systems, particularly RSA and ECC, could eventually be compromised, posing systemic risks to confidentiality, integrity, and authentication in financial transactions. To manage this risk, the Bank for International Settlements – BIS’ report proposes a three phases transition framework: 1️⃣ preparing for quantum risk awareness and inventory mapping, 2️⃣ migrating to post-quantum cryptography (PQC) standards once finalized (notably by NIST), and 3️⃣ continuously validating and adapting systems to maintain resilience. Key players (central banks, financial market infrastructures (FMIs), and regulated entities) are advised to act immediately in assessing vulnerabilities and developing mitigation strategies. Cross sector coordination is emphasized as critical to ensure a synchronized and effective transition. The report also highlights the need to prioritize migration in critical areas, such as #payments, #settlement systems, #authentication, and #digitalidentities, all of which rely heavily on cryptographic standards that will become obsolete within a quantum powered processing context. Key conclusions: ➡️ Early experimentation and engagement with standards bodies (e.g., NIST, ETSI) are encouraged to reduce transition friction. ➡️ Financial authorities and central banks should lead by example, upgrading their own systems and setting expectations for regulated entities and financial infrastructures. ➡️ Priority areas for quantum readiness include payment and settlement systems, digital identity schemes, secure communications, and authentication frameworks. ➡️ The risk is not just technical , interdependencies across systems mean that even a single weak link could jeopardize broader financial stability. ➡️ While large-scale quantum attacks may still be a decade away, “harvest now, decrypt later” threats are already plausible, making early action essential. While a full quantum threat may may not be (very) short term, the long lead times required for cryptographic system migration, the high interdependency of financial networks, and the regulatory implications make it imperative to act now. BIS calls for global alignment and proactive leadership to ensure that the transition to quantum-resilient systems is orderly, inclusive, and secure. #technology #ditigal #risk #banking

🚨𝗬𝗼𝘂’𝗿𝗲 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗻𝗴 𝗗𝗮𝘁𝗮 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗣𝗮𝘀𝘁, 𝗡𝗼𝘁 𝗳𝗼𝗿 𝘁𝗵𝗲 𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗙𝘂𝘁𝘂𝗿𝗲 Your data may already be compromised. You just don’t know it yet. Most security strategies assume yesterday’s threats. Quantum changes the timeline, not just the technology. Quantum computing doesn’t need to exist at scale to break today’s security. 'Harvest now and Decrypt later has already changed the risk equation. This paper by Mastercard is a wake-up call for #governments, #enterprises, #CISOs and #boards preparing for a post-quantum world. 𝗧𝗵𝗲 𝗞𝗲𝘆 𝗜𝗻𝘀𝗶𝗴𝗵𝘁𝘀 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗤𝘂𝗮𝗻𝘁𝘂𝗺 𝗧𝗵𝗿𝗲𝗮𝘁 The real risk is time. • Encrypted data can be stolen today and decrypted later • Long-life data (health, defence, IP, identity) is most exposed • Quantum resource estimates show this is not theoretical anymore 𝗧𝗿𝗮𝗻𝘀𝗶𝘁𝗶𝗼𝗻𝗶𝗻𝗴 𝘁𝗼 𝗤𝘂𝗮𝗻𝘁𝘂𝗺-𝗦𝗮𝗳𝗲 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 Risk management must start before quantum arrives. • Crypto agility is now a strategic requirement • Post-Quantum Cryptography (PQC) emerges as the most scalable path • Quantum safety is about migration planning, not last-minute swaps Security teams must plan for years, not upgrades. 𝗠𝗮𝗻𝗱𝗮𝘁𝗲𝘀 & 𝗥𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻𝘀 𝗔𝗿𝗲 𝗖𝗮𝘁𝗰𝗵𝗶𝗻𝗴 𝗨𝗽 Governments are already moving. • Global mandates now require quantum-safe migration plans • Clear guidance is emerging on PQC vs QKD use cases • Public sector action will soon cascade into enterprise obligations • Compliance pressure will arrive faster than most expect. 𝗣𝗲𝗿𝗳𝗼𝗿𝗺𝗮𝗻𝗰𝗲 & 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗥𝗲𝗮𝗹𝗶𝘁𝘆 Quantum-safe doesn’t mean business-safe by default. • PQC algorithms vary widely in performance impact • TLS needs redesign, not patching • Hybrid approaches are becoming the practical bridge strategy • Security teams must balance safety, latency, and scale. 𝗣𝗤𝗖 𝗠𝗶𝗴𝗿𝗮𝘁𝗶𝗼𝗻 𝗜𝘀 𝗮 𝗣𝗿𝗼𝗴𝗿𝗮𝗺𝗺𝗲, 𝗡𝗼𝘁 𝗮 𝗣𝗿𝗼𝗷𝗲𝗰𝘁 Migration is the hardest part. • Inventory cryptographic assets first • Prioritise systems with long data retention • Test, phase and monitor continuously • There is no “one-and-done” quantum fix. 𝗞𝗲𝘆 𝗧𝗮𝗸𝗲𝗮𝘄𝗮𝘆𝘀 ✅ Quantum risk is a present-day governance issue ✅ Waiting for quantum computers is already too late ✅ PQC migration will define future cyber resilience ✅ Security leaders must act before regulators force the move 𝗕𝗼𝘁𝘁𝗼𝗺 𝗟𝗶𝗻𝗲 Quantum security is no longer about cryptography. It’s about foresight, governance, and timing. Those who migrate early will set the standard and who delay will inherit the risk. 👉 If data is harvested today, when does the liability actually begin? #Quantum #QuantumSecurity #PostQuantumCryptography #CyberRisk #AIandQuantum #Governance #CISO #Board #DigitalTrust #TechforGood

NIST – Migration to Post-Quantum Cryptography Quantum Readiness outlines a comprehensive framework for transitioning cryptographic systems to post-quantum cryptography (PQC) in response to the emerging threat of quantum computers. Quantum technology is advancing rapidly and poses a significant risk to current public-key cryptographic methods like RSA, ECC, and DSA. This guide aims to assist organizations in preparing for and implementing PQC to safeguard sensitive data and critical systems. Key Points  The Quantum Threat Quantum computers are expected to disrupt cryptography by efficiently solving mathematical problems that underpin widely used encryption and key exchange methods. This would render current public-key systems ineffective in protecting sensitive data, emphasizing the need for cryptographic agility.  NIST PQC Standards NIST is spearheading efforts to standardize quantum-resistant algorithms through an open competition and evaluation process. These algorithms, designed to withstand quantum attacks, focus on two primary areas: 1. Key Establishment: Protecting methods like Diffie-Hellman and RSA key exchange. 2. Digital Signatures: Securing authentication processes.  Migration Framework The document provides a phased approach to migrating cryptographic systems to PQC: 1. Assessment Phase:    - Inventory cryptographic dependencies in current systems.    - Evaluate systems at risk from quantum threats based on sensitivity and lifespan. 2. Preparation Phase:    - Conduct pilot testing of candidate PQC algorithms in existing infrastructure.    - Develop a hybrid approach that combines classical and post-quantum algorithms to ensure interoperability during transition. 3. Implementation Phase:    - Replace vulnerable cryptographic methods with PQC in a phased manner.    - Ensure scalability, performance, and compatibility with existing systems. 4. Monitoring and Updates:    - Continuously monitor the effectiveness of implemented solutions.  Challenges in PQC Migration - Performance Impact: PQC algorithms often have larger key sizes, increased latency, and greater computational demands compared to classical algorithms. - Interoperability: Ensuring smooth integration with legacy systems poses significant technical challenges.  Best Practices - Use hybrid encryption to maintain compatibility while testing PQC algorithms. - Engage in collaboration with vendors, industry groups, and government initiatives to align with best practices and standards. Conclusion The transition to post-quantum cryptography is a proactive measure to secure data and communications against future threats. NIST emphasizes the importance of starting preparations immediately to mitigate risks and ensure a smooth, efficient migration process. Organizations should focus on inventorying dependencies, piloting PQC solutions, and developing cryptographic agility to adapt to this transformative technological shift.